shithub: tlssrv.sni

Info  •  Files  •  Log

limit size and null terminate server name identifier

--- a/tlshand.c

+++ b/tlshand.c

@@ -670,8 +670,11 @@

 			p += 2;

 			if(e-p < (n = get16(p-2)))

 				goto Short;

-			c->serverName = emalloc(n);

+			if(n > 255)				/* DNS name can not exceed 255 bytes RFC1035 */

+				break;

+			c->serverName = emalloc(n+1);

 			memmove(c->serverName, p, n);

+			c->serverName[n] = 0;

 			break;

 		case Extec:

 			if(n < 4 || n % 2 || get16(p) != (n -= 2))